1 / 28

Incident Response Technologies Dr. Cliff Zou University of Central Florida

Incident Response Technologies Dr. Cliff Zou University of Central Florida. Prerequisites. Good knowledge on computer networking TCP/IP protocols, IP packets, network layered architecture Network devices: routers, firewalls, switches Network application protocols: HTTP, SMTP, DNS, ICMP…

jcoursey
Download Presentation

Incident Response Technologies Dr. Cliff Zou University of Central Florida

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. Incident Response TechnologiesDr. Cliff ZouUniversity of Central Florida

  2. Prerequisites • Good knowledge on computer networking • TCP/IP protocols, IP packets, network layered architecture • Network devices: routers, firewalls, switches • Network application protocols: HTTP, SMTP, DNS, ICMP… • Knowledge on basic computer architecture and operating system • We will introduce Windows and Linux OS forensic analysis • Basic usage of Unix machine • We will need to install Kali Linux in Virtual Machine for Linux OS analysis and Penetration Testing

  3. Objectives • Understand basic knowledge and procedure on handling with cyber security attack, data breach, data damage incidents; • Able to conduct basic forensic analysis of Windows and Linux systems; • Able to use popular tools in analyzing compromised systems and conducting static and dynamic malware analysis;

  4. Objectives • Able to conduct basic penetration testing • Information gathering • Google search, social network search • Scanning • Exploitation (Use Kali Linux tools) • Able to use Wireshark for network traffic capture and analysis • Basic usage of Splunk to process and analyze security logs

  5. Planned Lecture Outline • Course outline and introduction • Background knowledge: Basic Networking Principles • Virtual Machine and installation of VirtualBox • Installation of Kali Linux VM • Linux basic usage and administration • Wireshark usage and network traffic analysis • Malware Incident Response • Static Analysis • Dynamic Analysis

  6. Planned Lecture Outline • Basic Reverse Engineering • Windows Incident Response and Event Log Analysis • Linux Incident Response and Event Log Analysis • Learn how to use Splunk software for Incident Response and log analysis

  7. Course Materials • No required textbook • Reference books: • The Basics of Hacking and Penetration Testing (2nd edition) by Patrick Engebretson (2013). • Network Forensics: Tracking Hackers through Cyberspace, by Sherri Davidoff and Jonathan Ham (2012). ISBN-10: 0132564718, ISBN-13: 978-0132564717 • Online References: • Google search to find many other universities teaching of Incident Response courses by search the term • “incident response syllabus site:edu ” • Wikipedia resources

  8. What is an incident? • Event • An observable occurrence on a system or network. • Adverse event • An event with negative consequences. • Computer security incident • Any unlawful, unauthorized or unacceptable action that involves a computer system or a computer network. • Violation or imminent threat to computer security policies, acceptable use policies, or standard security practices. http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf

  9. Examples of Incidents • Malicious code • Viruses, worms, logic bombs, Trojans • Denial of Service • Overwhelming network services with tidal waves of packets. • Unauthorized access • Accessing information or systems which a user is not authorized to use. • Inappropriate usage • Browsing for porn on lunch hour. • Installing and using peer-to-peer (P2P) applications for file sharing. • Install a Wifi router to bypass company monitoring • UCF does not allow student labs to set up their own Wifi routers (why?)

  10. Information Security Principles The “CIA” Principle: • Confidentiality • Only authorized users can view information. • Integrity • Internally consistent. • Freedom from unauthorized changes. • Availability • Resource is available for use when needed.

  11. Incident Response Policy, Plan, and Procedure Policy Elements: • Statement of management commitment • Purpose and objectives of the policy • Scope of the policy (to whom and what it applies and under what circumstances) • Definition of computer security incidents and related terms • Organizational structure and definition of roles, responsibilities, and levels of authority • Prioritization or severity ratings of incidents • Performance measures • Reporting and contact forms

  12. Incident Response Policy, Plan, and Procedure, cont’d Plan Elements: Organizations should have a formal, focused, and coordinated approach to responding to incidents, including an incident response plan that provides the roadmap for implementing the incident response capability. Procedure Elements: Procedures should be based on the incident response policy and plan. Standard operating procedures (SOPs) are a delineation of the specific technical processes, techniques, checklists, and forms used by the incident response team.

  13. Sharing Information With Outside Parties

  14. Handling an Incident: Incident Response Life Cycle

  15. Incident Response Methodology • Pre-incident preparation • Detection of incidents • Initial response • Formulate response strategy • Investigate the incident • Reporting • Resolution (and Improvement)

  16. Pre-Incident Preparation • For the organization • This is where pro-active measures can be implemented. • For the Computer Security Incident Response Team (CSIRT) • Hardware and software needs. • Forms and checklists for documenting incidents. • Staff training.

  17. Who Is Involved? • Human resource personnel, legal counsel, technical experts, security professionals, corporate security officers, business managers, end users, help desk workers, and other employees. • Computer Security Incident Response Team (CSIRT) • A dynamic team assembled when an organization requires its capabilities.

  18. Detection of Incidents • One of the most important aspects of incident response. • Items which should be recorded: • Current date and time • Who/what reported the incident • Nature of the incident • When the incident occurred • Hardware/software involved • Points of contact for involved personnel

  19. Initial Response • Involves assembling the CSIRT, collecting network-based and other data, determining the type of incident that has occurred, and assessing the impact of the incident. • Document steps that must be taken. • Team must verify that an incident has actually occurred, which systems are directly or indirectly affected, which users are involved, and the potential business impact.

  20. Formulate a Response Strategy • Goal is to determine the most appropriate response strategy given the circumstances of the incident. • Factors to consider: • How critical are the affected systems? • How sensitive is the compromised or stolen information? • Who are the potential perpetrators? • Is the incident known to the public? • What is the level of unauthorized access attained by the attacker? • What is the apparent skill of the attacker? • How much system and user downtime is involved? • What is the overall dollar loss?

  21. Taking Action • Legal • File a civil complaint and/or notify law enforcement. • Administrative • Usually has to deal with internal employees who have violated workplace policies.

  22. Investigating the Incident • Data Collection • Host-based information, network-based information, and other information. • Collected from a live running system or one that is turned off. • Must be collected in a forensically sound manner. • Collect in a manner that protects its integrity (evidence handling). • Forensic Analysis • Reviewing items such as log files, system configuration files, items left behind on a system, files modified, installed applications (possible hacker tools), etc. • Could involve many types of tools and techniques. • May lead to additional data collection.

  23. Reporting • Keys to making this phase successful: • Document immediately. • Write concisely and clearly. Don’t use shorthand. • Use a standard format. • Have someone else review to ensure accuracy and completeness.

  24. Resolution • Three steps: • Contain the problem. • Solve the problem. • Take steps to prevent the problem from occurring again.

  25. Incident Handling Checklist

  26. Incident Response Coordination

  27. Outcomes • Better security mean reduced incidents. • Be proactive to provide security services: • Physical • Network • Workstation • User training • Be prepared • Have a plan. • An incident response plan is vital. It is the blueprint for dealing with incidents. • A well-executed response can uncover the true extent of a compromise and prevent future occurrences.

  28. Questions?

More Related